feat(reference-app): name the requesting client and describe scopes on consent (#194)

* feat(reference-app): adopt Pico CSS for the login, logout, and landing pages

Vendors Pico v2.1.1 as static/pico.min.css and restyles the pages as a centered card. Login now pre-fills the demo credentials with a caption so they are obvious. Page titles are normalized to h1, and the screenshot viewport is pinned to 576x520 so captures are a uniform, GitHub-column-friendly size.

* feat(reference-app): collapse the code and token values behind disclosures

The callback page leads with a prominent Exchange button and an honest note that a real app does this server-side; the raw authorization code and the client credentials move into <details> disclosures. The tokens page leads with a success line and tucks the raw token response and decoded claims behind disclosures. This keeps the variable-length, non-deterministic content out of the default view so every screen is a fixed size.

* feat(reference-app): name the requesting client and describe scopes on consent

The consent screen now reads like a real client's: it names the requesting application and shows a plain-language description for each scope (with the raw scope name alongside), sourced from the consent challenge. Adds a RequestedScope catalog for the descriptions. Drops the redundant 'offline' scope, and gives the test clients a stable client_name so the screen is deterministic. Regenerates the README screenshots.

Author: ardetrick

docs/images/full-oauth-flow-oidc/1-initial-load.png

@@ -26,6 +26,7 @@ private static ModelAndView handleSkip(Skip consentResponseSkip) {
   private static ModelAndView handleDisplayUI(DisplayUI displayUI) {
     return new ModelAndView("consent")
         .addObject("consentChallenge", displayUI.consentChallenge())
+        .addObject("clientName", displayUI.clientName())
         .addObject("scopes", displayUI.requestedScopes());
   }
 

docs/images/full-oauth-flow-oidc/2-after-login-submit.png

@@ -10,7 +10,7 @@ public sealed interface ConsentResponse
 
   record Skip(String redirectTo) implements ConsentResponse {}
 
-  record DisplayUI(List<String> requestedScopes, String consentChallenge)
+  record DisplayUI(String clientName, List<RequestedScope> requestedScopes, String consentChallenge)
       implements ConsentResponse {}
 
   record Accepted(String redirectTo) implements ConsentResponse {}